Checkview
Monthly
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. A publicly available exploit from WPScan demonstrates this path; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. A publicly available exploit from WPScan demonstrates this path; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.